Is it possible to run PHP exec () but hide the parameters from the process list?

Question

I would like to have a properly secured PHP web tool to run mysqlcheck for the general state of the database table, but I do not want the password to be visible in the process list. I would like to run something like this:

 $output = shell_exec('mysqlcheck -Ac -uroot -pxxxxx -hhostname'); // strip lines that OK echo '<pre>'.preg_replace('/^.+\\sOK$\\n?/m', '', $output).'</pre>'; 

Unfortunately, with shell_exec() , I have to specify the password on the command line, but I am worried that the password will be displayed in the process list ( ps -A | grep mysqlcheck ).

Using mariadb 5.5 on my test machine, mysqlcheck does not display the password in the process list, but my production machine does not start mariadb and does not start another OS, and I would like to be safe and not run these tests on the production side.

Do all mysql versions also hide the password in the process list? Is my problem not a problem?

Answer 1

Yes, since at least MySQL 5.1, the client obscures the password on the command line.

I found this blog by the former MySQL community manager Lenz Grimmer since 2009, in which he linked to the appropriate code in MySQL 5.1 source. http://www.lenzg.net/archives/256-Basic-MySQL-Security-Providing-passwords-on-the-command-line.html

You can also not pass the password at all on the command line and instead store the user / password credentials in a file that PHP has to read, and then execute it as:

 mysqlcheck --defaults-extra-file=/etc/php.d/mysql-client.cnf 

The file name is an example; You can specify any path you want. The fact is that most MySQL client tools accept the --defaults-extra-file option. See http://dev.mysql.com/doc/refman/5.6/en/option-file-options.html for details.

Answer 2

This is a real problem, and your OS will show it, it simply cannot be in the default view.

Instead, you can proc_open , which allows you to read and write to the stream opened by this file.

 mysqlcheck -Ac -uroot -p -hhostname 

will ask for a password that you can record using pipes from proc_open